Publish Codex installer assets to R2

Co-authored-by: Zsolt Dollenstein <zsol.zsol@gmail.com>

.github/workflows/r2-release.yml

@@ -0,0 +1,45 @@
+name: publish-r2-release
+
+on:
+  workflow_run:
+    workflows: [rust-release]
+    types: [completed]
+
+permissions: {}
+
+concurrency:
+  group: publish-r2-release-${{ github.event.workflow_run.id }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: codex-r2-publisher
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.11.28"
+
+      - name: Validate and publish installer assets to R2
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CODEX_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CODEX_R2_SECRET_ACCESS_KEY }}
+          AWS_ENDPOINT_URL: ${{ vars.CODEX_R2_ENDPOINT_URL }}
+          AWS_REGION: ${{ vars.CODEX_R2_REGION }}
+        run: |
+          set -euo pipefail
+          uv run --locked --script .github/scripts/publish_r2_release.py \
+            --event "${GITHUB_EVENT_PATH}"